Cilefen

An issue exists in Drupal Patreon that affects the software's security.

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module integrates the MathJax library, a JavaScript-based LaTeX rendering solution, but includes library configurations that fail to escape JavaScript within the TeX it formats.

Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

An incorrect authorization issue in the Webform Submission Export/Import submodule allows for Server Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The submodule fails to sufficiently validate access to its export and import functionality. Consequently, a user with permissions to edit webform submissions and access webform results can access the import interface, including the remote URL import path.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.

The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request can cause excessive resource consumption, resulting in a Denial of Service. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can exploit this to perform cross-site scripting (XSS) within the submodule settings. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.

An incorrect authorization issue allows forceful browsing within the Webform module. The module fails to sufficiently restrict access to specific submission view modes. Consequently, a user with permission to view a submission may access a more permissive view mode to see fields that should be restricted. This requires the attacker to already possess access to view the affected submission.

An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict submission access to selected user accounts may inadvertently grant access to anonymous users. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

Insufficient permission checks for webform and webform submission entities when retrieving webform elements or fields allow for forceful browsing. This occurs within the module used to retrieve and submit webforms via REST.

The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The module fails to sufficiently filter response values from the Remote Post handler before they are rendered through handler response tokens. Consequently, if a site uses these tokens in rendered output, a remote endpoint could return values that are rendered as HTML, leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites. Approximately 436,300 instances were identified globally.

Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons.

An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to sufficiently protect the comparison of access tokens, enabling a persistent attacker to perform a timing attack—a method of guessing secret data by measuring how long a system takes to respond—to discover a valid token and bypass access restrictions. Exploitation requires the attacker to know the URL of the protected content and accurately measure timing differences in the responses.

Incorrect authorization in the module allows forceful browsing. The module fails to sufficiently verify permissions for creating, viewing, and updating the parent webform when accessing REST endpoints. This issue requires the attacker to already possess permissions to use the REST resource.

A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails to sufficiently check access permissions, which may allow unauthorized users to view images that should be restricted.

A missing authorization issue in the `wisski mirador` submodule allows forceful browsing and access bypass. The module fails to sufficiently validate parameters submitted via a route before writing them to the session object.

An SQL injection issue exists in the Drupal Geolocation Field module, which provides functionality to store coordinates and supports views and other modules. The problem occurs because one of the views filters does not sufficiently sanitize values when they are exposed to user input. This allows for the improper neutralization of special elements used in an SQL command. The risk is limited to scenarios where a view is configured to use the affected filter and is set to accept user input.

The `rebuild.php` front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted host patterns. This flaw can lead to cache poisoning, where a cache is filled with a malicious response, or an open redirect, which sends users to an attacker-controlled domain.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.